Hire Dedicated WordPress Developers For Traditional or Headless Development

<?php
/**
 * Plugin Name: Custom Data Manager
 * Description: Secure custom data handling with WordPress best practices
 * Version: 1.0.0
 * Requires PHP: 8.1
 */

declare(strict_types=1);

namespace CustomDataManager;

// Prevent direct access
defined('ABSPATH') || exit;

/**
 * Main plugin class using WordPress hooks and security best practices
 */
final class Plugin
{
    private const VERSION = '1.0.0';
    private const TABLE_NAME = 'custom_data';
    private const CAPABILITY = 'manage_options';
    private const NONCE_ACTION = 'cdm_save_data';

    private static ?self $instance = null;

    public static function getInstance(): self
    {
        return self::$instance ??= new self();
    }

    private function __construct()
    {
        // Hook into WordPress lifecycle
        add_action('plugins_loaded', [$this, 'init']);
        register_activation_hook(__FILE__, [$this, 'activate']);
        register_deactivation_hook(__FILE__, [$this, 'deactivate']);
    }

    /**
     * Initialize plugin - register all hooks
     */
    public function init(): void
    {
        // Admin hooks
        add_action('admin_menu', [$this, 'registerAdminMenu']);
        add_action('admin_enqueue_scripts', [$this, 'enqueueAdminAssets']);
        add_action('admin_post_cdm_save', [$this, 'handleFormSubmission']);

        // AJAX handlers (both logged in and guest if needed)
        add_action('wp_ajax_cdm_fetch_data', [$this, 'ajaxFetchData']);

        // Custom filters for extensibility
        add_filter('cdm_before_save', [$this, 'sanitizeData'], 10, 2);
        add_filter('cdm_data_output', [$this, 'formatOutput'], 10, 1);

        // REST API endpoint
        add_action('rest_api_init', [$this, 'registerRestRoutes']);

        // Cron for maintenance
        add_action('cdm_daily_cleanup', [$this, 'performCleanup']);

        // Schedule cron if not exists
        if (!wp_next_scheduled('cdm_daily_cleanup')) {
            wp_schedule_event(time(), 'daily', 'cdm_daily_cleanup');
        }
    }

    /**
     * Plugin activation - create custom table with proper schema
     */
    public function activate(): void
    {
        global $wpdb;

        $table = $wpdb->prefix . self::TABLE_NAME;
        $charset = $wpdb->get_charset_collate();

        // Using dbDelta for safe table creation/updates
        $sql = "CREATE TABLE {$table} (
            id bigint(20) unsigned NOT NULL AUTO_INCREMENT,
            user_id bigint(20) unsigned NOT NULL DEFAULT 0,
            data_key varchar(191) NOT NULL,
            data_value longtext NOT NULL,
            created_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
            updated_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
            PRIMARY KEY (id),
            KEY user_id (user_id),
            KEY data_key (data_key),
            KEY created_at (created_at)
        ) {$charset};";

        require_once ABSPATH . 'wp-admin/includes/upgrade.php';
        dbDelta($sql);

        // Store version for future migrations
        update_option('cdm_db_version', self::VERSION);

        // Clear any cached transients
        $wpdb->query(
            "DELETE FROM {$wpdb->options}
             WHERE option_name LIKE '\_transient\_cdm\_data\_%'
             OR option_name LIKE '\_transient\_timeout\_cdm\_data\_%'"
        );
    }

    /**
     * Plugin deactivation - cleanup scheduled events
     */
    public function deactivate(): void
    {
        wp_clear_scheduled_hook('cdm_daily_cleanup');
    }

    /**
     * Secure data insertion with prepared statements
     */
    public function saveData(string $key, mixed $value, int $userId = 0): int|false
    {
        global $wpdb;

        // Apply filters for extensibility
        $sanitizedData = apply_filters('cdm_before_save', [
            'key' => $key,
            'value' => $value,
        ], $userId);

        $table = $wpdb->prefix . self::TABLE_NAME;

        // Always use prepared statements - NEVER concatenate user input
        $result = $wpdb->insert(
            $table,
            [
                'user_id' => $userId,
                'data_key' => sanitize_key($sanitizedData['key']),
                'data_value' => wp_json_encode($sanitizedData['value']),
            ],
            ['%d', '%s', '%s']  // Format specifiers prevent SQL injection
        );

        if ($result === false) {
            do_action('cdm_save_error', $wpdb->last_error, $sanitizedData);
            return false;
        }

        $insertId = $wpdb->insert_id;

        // Clear relevant transient caches
        delete_transient("cdm_data_{$key}_{$userId}");

        do_action('cdm_data_saved', $insertId, $sanitizedData);

        return $insertId;
    }

    /**
     * Secure data retrieval with caching
     */
    public function getData(string $key, int $userId = 0): mixed
    {
        global $wpdb;

        // Check transient cache first
        $cacheKey = "cdm_data_{$key}_{$userId}";
        $cached = get_transient($cacheKey);

        if ($cached !== false) {
            return apply_filters('cdm_data_output', $cached);
        }

        $table = $wpdb->prefix . self::TABLE_NAME;

        // Prepared statement for secure query
        $row = $wpdb->get_row(
            $wpdb->prepare(
                "SELECT data_value FROM {$table}
                 WHERE data_key = %s AND user_id = %d
                 ORDER BY created_at DESC LIMIT 1",
                sanitize_key($key),
                $userId
            )
        );

        $value = $row ? json_decode($row->data_value, true) : null;

        // Cache for 1 hour
        set_transient($cacheKey, $value ?? '', HOUR_IN_SECONDS);

        return apply_filters('cdm_data_output', $value);
    }

    /**
     * Handle form submission with full security checks
     */
    public function handleFormSubmission(): void
    {
        // 1. Verify user capability
        if (!current_user_can(self::CAPABILITY)) {
            wp_die(
                esc_html__('Unauthorized access', 'cdm'),
                403
            );
        }

        // 2. Verify nonce - CRITICAL for CSRF protection
        if (!isset($_POST['_wpnonce']) ||
            !wp_verify_nonce(
                sanitize_text_field(wp_unslash($_POST['_wpnonce'])),
                self::NONCE_ACTION
            )
        ) {
            wp_die(
                esc_html__('Security check failed', 'cdm'),
                403
            );
        }

        // 3. Validate and sanitize all inputs
        $dataKey = isset($_POST['data_key'])
            ? sanitize_key(wp_unslash($_POST['data_key']))
            : '';

        $dataValue = isset($_POST['data_value'])
            ? wp_kses_post(wp_unslash($_POST['data_value']))
            : '';

        if (empty($dataKey)) {
            wp_safe_redirect(
                add_query_arg('error', 'missing_key', wp_get_referer())
            );
            exit;
        }

        // 4. Save data
        $result = $this->saveData($dataKey, $dataValue, get_current_user_id());

        // 5. Redirect with status (PRG pattern)
        $redirectUrl = add_query_arg(
            $result ? ['success' => '1'] : ['error' => 'save_failed'],
            admin_url('admin.php?page=cdm-settings')
        );

        wp_safe_redirect($redirectUrl);
        exit;
    }

    /**
     * AJAX handler with security
     */
    public function ajaxFetchData(): void
    {
        // Verify AJAX nonce
        check_ajax_referer('cdm_ajax_nonce', 'security');

        if (!current_user_can('read')) {
            wp_send_json_error(['message' => 'Unauthorized'], 403);
        }

        $key = isset($_GET['key'])
            ? sanitize_key(wp_unslash($_GET['key']))
            : '';

        if (empty($key)) {
            wp_send_json_error(['message' => 'Invalid key'], 400);
        }

        $data = $this->getData($key, get_current_user_id());

        wp_send_json_success(['data' => $data]);
    }

    /**
     * Register REST API routes
     */
    public function registerRestRoutes(): void
    {
        register_rest_route('cdm/v1', '/data/(?P<key>[a-z0-9_-]+)', [
            'methods' => 'GET',
            'callback' => [$this, 'restGetData'],
            'permission_callback' => function () {
                return current_user_can('read');
            },
            'args' => [
                'key' => [
                    'required' => true,
                    'sanitize_callback' => 'sanitize_key',
                    'validate_callback' => fn($v) => !empty($v),
                ],
            ],
        ]);
    }

    /**
     * REST endpoint callback
     */
    public function restGetData(\WP_REST_Request $request): \WP_REST_Response
    {
        $key = $request->get_param('key');
        $data = $this->getData($key, get_current_user_id());

        return new \WP_REST_Response([
            'success' => true,
            'data' => $data,
        ], 200);
    }

    /**
     * Admin page with proper output escaping
     */
    public function renderAdminPage(): void
    {
        if (!current_user_can(self::CAPABILITY)) {
            return;
        }

        $allData = $this->getAllData(get_current_user_id());
        ?>
        <div class="wrap">
            <h1><?php echo esc_html(get_admin_page_title()); ?></h1>

            <?php if (isset($_GET['success'])): ?>
                <div class="notice notice-success is-dismissible">
                    <p><?php esc_html_e('Data saved successfully.', 'cdm'); ?></p>
                </div>
            <?php elseif (isset($_GET['error'])): ?>
                <div class="notice notice-error is-dismissible">
                    <p><?php echo esc_html(
                        match (sanitize_key($_GET['error'])) {
                            'missing_key' => __('Data key is required.', 'cdm'),
                            'save_failed' => __('Failed to save data. Please try again.', 'cdm'),
                            default => __('An error occurred.', 'cdm'),
                        }
                    ); ?></p>
                </div>
            <?php endif; ?>

            <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
                <?php wp_nonce_field(self::NONCE_ACTION); ?>
                <input type="hidden" name="action" value="cdm_save">

                <table class="form-table">
                    <tr>
                        <th scope="row">
                            <label for="data_key">
                                <?php esc_html_e('Data Key', 'cdm'); ?>
                            </label>
                        </th>
                        <td>
                            <input type="text"
                                   id="data_key"
                                   name="data_key"
                                   class="regular-text"
                                   pattern="[a-z0-9_-]+"
                                   required>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row">
                            <label for="data_value">
                                <?php esc_html_e('Data Value', 'cdm'); ?>
                            </label>
                        </th>
                        <td>
                            <?php
                            wp_editor('', 'data_value', [
                                'textarea_rows' => 10,
                                'media_buttons' => false,
                            ]);
                            ?>
                        </td>
                    </tr>
                </table>

                <?php submit_button(__('Save Data', 'cdm')); ?>
            </form>

            <h2><?php esc_html_e('Stored Data', 'cdm'); ?></h2>
            <table class="wp-list-table widefat fixed striped">
                <thead>
                    <tr>
                        <th><?php esc_html_e('Key', 'cdm'); ?></th>
                        <th><?php esc_html_e('Value', 'cdm'); ?></th>
                        <th><?php esc_html_e('Created', 'cdm'); ?></th>
                    </tr>
                </thead>
                <tbody>
                    <?php foreach ($allData as $row): ?>
                        <tr>
                            <td><?php echo esc_html($row->data_key); ?></td>
                            <td><?php echo wp_kses_post(
                                wp_trim_words(json_decode($row->data_value, true) ?? '', 20)
                            ); ?></td>
                            <td><?php echo esc_html(
                                wp_date(get_option('date_format'), strtotime($row->created_at))
                            ); ?></td>
                        </tr>
                    <?php endforeach; ?>
                </tbody>
            </table>
        </div>
        <?php
    }

    /**
     * Get all data with pagination support
     */
    private function getAllData(int $userId, int $limit = 50, int $offset = 0): array
    {
        global $wpdb;

        $table = $wpdb->prefix . self::TABLE_NAME;

        return $wpdb->get_results(
            $wpdb->prepare(
                "SELECT * FROM {$table}
                 WHERE user_id = %d
                 ORDER BY created_at DESC
                 LIMIT %d OFFSET %d",
                $userId,
                $limit,
                $offset
            )
        );
    }

    public function registerAdminMenu(): void
    {
        add_menu_page(
            __('Custom Data Manager', 'cdm'),
            __('Data Manager', 'cdm'),
            self::CAPABILITY,
            'cdm-settings',
            [$this, 'renderAdminPage'],
            'dashicons-database',
            80
        );
    }

    public function enqueueAdminAssets(string $hook): void
    {
        if ($hook !== 'toplevel_page_cdm-settings') {
            return;
        }

        wp_enqueue_style(
            'cdm-admin',
            plugin_dir_url(__FILE__) . 'assets/css/admin.css',
            [],
            self::VERSION
        );

        wp_enqueue_script(
            'cdm-admin',
            plugin_dir_url(__FILE__) . 'assets/js/admin.js',
            ['jquery'],
            self::VERSION,
            true
        );

        wp_localize_script('cdm-admin', 'cdmAjax', [
            'url' => admin_url('admin-ajax.php'),
            'nonce' => wp_create_nonce('cdm_ajax_nonce'),
        ]);
    }

    public function sanitizeData(array $data, int $userId): array
    {
        $data['key'] = sanitize_key($data['key'] ?? '');
        $data['value'] = wp_kses_post($data['value'] ?? '');
        return $data;
    }

    public function formatOutput(mixed $data): mixed
    {
        if (is_string($data)) {
            return wp_kses_post($data);
        }
        return $data;
    }

    public function performCleanup(): void
    {
        global $wpdb;
        $table = $wpdb->prefix . self::TABLE_NAME;

        // Remove entries older than 1 year
        $wpdb->query(
            $wpdb->prepare(
                "DELETE FROM {$table} WHERE created_at < %s",
                gmdate('Y-m-d H:i:s', strtotime('-1 year'))
            )
        );
    }
}

// Initialize plugin
Plugin::getInstance();